Designing Comprehensive Cyber Threat Analysis Platform: Can We Orchestrate Analysis Engines?

To cope with growing cyber threats on the Internet, various techniques have been proposed and implemented. Each of these techniques automates specific tasks of cybersecurity operations, and operators in the field locate and choose multiple tools and conduct security operations by subsequently using the tools and combining their outputs. Recent studies have been introducing many automation techniques for specific security tasks, but their combined use has not been thoroughly studied until now. To advance security automation further, a series of cybersecurity operation tasks needs to be automated by orchestrating different techniques. In this paper, we propose the cyber threat hybrid analysis platform, which orchestrates multiple automation techniques to expand their applicable scope. We also demonstrate the platform's usability and feasibility by describing a case study with a real malware sample.